Question

A team runs a payments API in the namespace 'payments' with pods labeled 'app=payments-api'. Security requires that only pods running in namespaces labeled 'tier=frontend' be allowed to connect to the payments API on TCP port 8443, and all other ingress must be denied. No NetworkPolicy currently exists in the 'payments' namespace. Which NetworkPolicy correctly enforces this requirement?

Accepted Answer

A policy in 'payments' with podSelector matching 'app=payments-api', policyTypes: [Ingress], and an ingress rule with a 'from' entry using namespaceSelector matchLabels 'tier=frontend' and ports 8443/TCP.

Answer

A policy in 'payments' with podSelector matching 'app=payments-api', policyTypes: [Ingress], and an ingress rule with a 'from' entry using podSelector matchLabels 'tier=frontend' and ports 8443/TCP.

Answer

A policy in each frontend namespace with an empty podSelector, policyTypes: [Egress], allowing egress to namespaceSelector 'app=payments-api' on port 8443/TCP.

Answer

A policy in 'payments' with podSelector matching 'app=payments-api' and policyTypes: [Ingress] but no ingress rules defined, relying on the namespace label to permit frontend traffic.